expressa 2.1.0 → 2.1.2

package/controllers/collections.js

@@ -1,260 +1,299 @@
-const debug = require('debug')('expressa')
-const MongoQS = require('mongo-querystring')
-
-const util = require('../util')
-const queryStringParser = new MongoQS({})
-
-function assertValidCollection(req) {
-  if (!req.db[req.params.collection]) {
-    throw new util.ApiError(404, 'unknown collection')
-  }
-}
-
-async function validateDocumentOwner(req, doc) {
-  if (!doc.meta.owner_collection) {
-    throw new util.ApiError(417, 'no owner_collection for owner found')
-  }
-  util.validateSchemaProperty(req.params.collection, 'meta.owner_collection', doc.meta.owner_collection)
-  if (!(doc._id === doc.meta.owner && req.params.collection === doc.meta.owner_collection)) {
-    const count = await req.db[doc.meta.owner_collection].count({ _id: doc.meta.owner }, undefined, 1)
-    if (!count) {
-      throw new util.ApiError(417, 'invalid owner')
-    }
-  }
-  util.validateSchemaProperty(doc.meta.owner_collection, 'meta.owner', doc.meta.owner)
-}
-
-async function setDocumentOwner(req, doc) {
-  const schema = await req.db.collection.get(req.params.collection)
-  if (schema.documentsHaveOwners) {
-    util.addIdIfMissing(doc)
-    doc.meta ??= {}
-    if (req.uid) {
-      // request done by logged in user
-      if (!doc.meta.owner) {
-        // no owner - make logged in user as owner
-        doc.meta.owner = req.user._id
-        doc.meta.owner_collection = req.ucollection
-      } else {
-        if (!req.hasPermission(`${req.params.collection}: modify owner`)) {
-          // has an owner - but if no permission to modify owner then override owner to logged in user
-          doc.meta.owner = req.user._id
-          doc.meta.owner_collection = req.ucollection
-        }
-      }
-    } else {
-      // request done by NOT logged in user
-      if (schema.enableLogin) {
-        // is a user/login collection so make self owner
-        doc.meta.owner = doc._id
-        doc.meta.owner_collection = req.params.collection
-      } else {
-        // is a normal collection
-        debug('unable to find valid owner')
-      }
-    }
-    if (doc.meta.owner) {
-      await validateDocumentOwner(req, doc)
-    }
-  }
-}
-
-exports.getSchema = async function (req) {
-  const collection = await req.db.collection.get(req.params.collection)
-  await util.notify('get', req, 'schemas', collection)
-  return collection.schema
-}
-
-exports.get = async function (req) {
-  assertValidCollection(req)
-  if (typeof req.db[req.params.collection] === 'undefined') {
-    throw new util.ApiError(404, 'unknown collection')
-  }
-
-  const fields = req.query.fields ? JSON.parse(req.query.fields) : null
-
-  let data, query
-  if (req.query.query) {
-    query = JSON.parse(req.query.query)
-  }
-  else {
-    const { skip, offset, limit, page, pageitems, pagemetadisable, orderby, ...params } = req.query // eslint-disable-line no-unused-vars
-    delete params.fields
-    query = queryStringParser.parse(params)
-  }
-  if (req.query.orderby) {
-    req.query.orderby = JSON.parse(req.query.orderby)
-    req.query.orderby = util.normalizeOrderBy(req.query.orderby)
-  }
-
-  if (req.uid) {
-    // scenario where logged in user can only retrieve own docs
-    if (!req.hasPermission(`${req.params.collection}: view`) && req.hasPermission(`${req.params.collection}: view own`)) {
-      query['meta.owner'] = req.uid
-      // if fields is null then all fields are requested
-      if (fields) fields['meta.owner'] = 1
-    }
-  }
-
-  if (req.query.page != null) {
-    req.query.page = parseInt(req.query.page)
-    if (req.query.page <= 0) {
-      throw new util.ApiError(400, 'invalid page number')
-    }
-    req.query.pageitems = parseInt(req.query.pageitems) || parseInt(req.query.limit) || 10
-    req.query.offset = util.getDatabaseOffset(req.query.page, req.query.pageitems)
-    req.query.orderby = util.orderByForPagedRequests(req.query.orderby)
-    delete req.query.limit
-    delete req.query.skip
-    let pageData, totalItems
-    if (req.query.pagemetadisable) {
-      // a way to skip the extra count database call, but lose additional page detail
-      pageData = await req.db[req.params.collection].find(query, req.query.offset, req.query.pageitems, req.query.orderby, fields)
-    }
-    else {
-      // this is default - full detail
-      [pageData, totalItems] = await Promise.all([
-        req.db[req.params.collection].find(query, req.query.offset, req.query.pageitems, req.query.orderby, fields),
-        req.db[req.params.collection].count(query)
-      ])
-    }
-    await Promise.all(pageData.map((doc) => util.notify('get', req, req.params.collection, doc)))
-    data = util.createPagePagination(pageData, req.query.page, req.query.pageitems, totalItems)
-  }
-  else {
-    if (req.query.limit) {
-      req.query.limit = parseInt(req.query.limit)
-    }
-    if (req.query.skip) {
-      req.query.offset = parseInt(req.query.skip)
-      delete req.query.skip
-    }
-    else if (req.query.offset) {
-      req.query.offset = parseInt(req.query.offset)
-    }
-    data = await req.db[req.params.collection].find(query, req.query.offset, req.query.limit, req.query.orderby, fields)
-    await Promise.all(data.map((doc) => util.notify('get', req, req.params.collection, doc)))
-  }
-
-  await util.notify('getpresend', req, req.params.collection, data)
-  return data
-}
-
-exports.insert = async function (req) {
-  assertValidCollection(req)
-  const data = req.body
-  req.customResponseData = req.customResponseData || {}
-  await util.notify('post', req, req.params.collection, data)
-  await setDocumentOwner(req, data)
-  const id = await req.db[req.params.collection].create(data)
-  await util.notify('changed', req, req.params.collection, data)
-  return {
-    status: 'OK',
-    id: id,
-    ...req.customResponseData,
-  }
-}
-
-exports.getById = async function (req) {
-  assertValidCollection(req)
-  const fields = req.query.fields ? JSON.parse(req.query.fields) : null
-  const data = await req.db[req.params.collection].get(req.params.id, fields)
-  await util.notify('get', req, req.params.collection, data)
-  await util.notify('getpresend', req, req.params.collection, data)
-  return data
-}
-
-exports.replaceById = async function (req) {
-  assertValidCollection(req)
-  req.customResponseData = req.customResponseData || {}
-  const data = req.body
-  let oldDoc = {}
-  try {
-    oldDoc = await req.db[req.params.collection].get(req.params.id)
-  } catch (error) {
-    // happens when new documents are created via a PUT
-    oldDoc = { meta: { owner: req.user._id, owner_collection: 'users' } }
-    data._id = req.params.id.trim()
-    await setDocumentOwner(req, data)
-  }
-  if (data._id) {
-    data._id = data._id.trim()
-  } else {
-    data._id = req.params.id.trim()
-  }
-  data.meta = data.meta || {}
-  data.meta.created = (oldDoc.meta || {}).created
-  if (data.meta.owner !== oldDoc.meta.owner || data.meta.owner_collection !== oldDoc.meta.owner_ollection) {
-    if (req.hasPermission(`${req.params.collection}: modify owner`)) {
-      if (oldDoc.meta.owner) {
-        await validateDocumentOwner(req, data)
-      }
-    } else {
-      debug('attempting to change document owner.')
-      data.meta.owner = oldDoc.meta.owner
-      data.meta.owner_collection = oldDoc.meta.owner_collection
-    }
-  }
-  await util.notify('put', req, req.params.collection, data)
-  await req.db[req.params.collection].update(req.params.id, data)
-  await util.notify('changed', req, req.params.collection, data)
-  return {
-    status: 'OK',
-    id: data._id,
-    ...req.customResponseData,
-  }
-}
-
-exports.updateById = async function (req) {
-  assertValidCollection(req)
-  req.customResponseData = req.customResponseData || {}
-  const modifier = req.body
-
-  const doc = await req.db[req.params.collection].get(req.params.id)
-  const owner = doc.meta && doc.meta.owner
-  const ownerCollection = doc.meta && doc.meta.owner_collection
-  util.mongoUpdate(doc, modifier)
-  const newOwner = doc.meta && doc.meta.owner
-  const newOwnerCollection = doc.meta && doc.meta.owner_collection
-  if (owner !== newOwner || ownerCollection !== newOwnerCollection) {
-    if (req.hasPermission(`${req.params.collection}: modify owner`)) {
-      if (owner) {
-        await validateDocumentOwner(req, doc)
-      }
-    } else {
-      debug('attempting to change document owner.')
-      doc.meta.owner = owner
-      doc.meta.owner_collection = ownerCollection
-    }
-  }
-  if (doc._id) {
-    doc._id = doc._id.trim()
-  } else {
-    throw new util.ApiError(400, '_id property is required')
-  }
-  req.body = doc
-  await util.notify('put', req, req.params.collection, doc)
-  await req.db[req.params.collection].update(req.params.id, req.body)
-  await util.notify('changed', req, req.params.collection, req.body)
-  if (Object.keys(req.customResponseData)) {
-    return {
-      ...doc,
-      ...req.customResponseData,
-    }
-  }
-  return doc
-}
-
-exports.deleteById = async function (req) {
-  assertValidCollection(req)
-  req.customResponseData = req.customResponseData || {}
-  const doc = await req.db[req.params.collection].get(req.params.id)
-  await util.notify('delete', req, req.params.collection, doc)
-
-  await req.db[req.params.collection].delete(req.params.id)
-  await util.notify('deleted', req, req.params.collection, doc)
-  return {
-    status: 'OK',
-    ...req.customResponseData,
-  }
-}
+const debug = require('debug')('expressa')
+const MongoQS = require('mongo-querystring')
+
+const util = require('../util')
+const queryStringParser = new MongoQS({})
+
+// Operators that the query engine compiles into executable JavaScript. Trusted
+// server-side callers of db.<collection>.find() may legitimately use them, but
+// they must never be accepted from an HTTP request, where they amount to
+// arbitrary code execution. See GHSA-vx6m-5p2v-fcvg.
+const CODE_EXECUTION_OPERATORS = ['$where', '$function']
+
+// Walks the whole query rather than only its top level, so an operator nested
+// inside $and/$or/$nor/$elemMatch is found too. Iterative on purpose: a
+// deeply nested query from an untrusted client should not be able to exhaust
+// the stack. Returns the offending operator, or undefined if there is none.
+function findCodeExecutionOperator (query) {
+  const pending = [query]
+  while (pending.length > 0) {
+    const value = pending.pop()
+    if (value === null || typeof value !== 'object') {
+      continue
+    }
+    if (Array.isArray(value)) {
+      for (const entry of value) {
+        pending.push(entry)
+      }
+      continue
+    }
+    for (const key of Object.keys(value)) {
+      if (CODE_EXECUTION_OPERATORS.includes(key)) {
+        return key
+      }
+      pending.push(value[key])
+    }
+  }
+  return undefined
+}
+
+function assertValidCollection(req) {
+  if (!req.db[req.params.collection]) {
+    throw new util.ApiError(404, 'unknown collection')
+  }
+}
+
+async function validateDocumentOwner(req, doc) {
+  if (!doc.meta.owner_collection) {
+    throw new util.ApiError(417, 'no owner_collection for owner found')
+  }
+  util.validateSchemaProperty(req.params.collection, 'meta.owner_collection', doc.meta.owner_collection)
+  if (!(doc._id === doc.meta.owner && req.params.collection === doc.meta.owner_collection)) {
+    const count = await req.db[doc.meta.owner_collection].count({ _id: doc.meta.owner }, undefined, 1)
+    if (!count) {
+      throw new util.ApiError(417, 'invalid owner')
+    }
+  }
+  util.validateSchemaProperty(doc.meta.owner_collection, 'meta.owner', doc.meta.owner)
+}
+
+async function setDocumentOwner(req, doc) {
+  const schema = await req.db.collection.get(req.params.collection)
+  if (schema.documentsHaveOwners) {
+    util.addIdIfMissing(doc)
+    doc.meta ??= {}
+    if (req.uid) {
+      // request done by logged in user
+      if (!doc.meta.owner) {
+        // no owner - make logged in user as owner
+        doc.meta.owner = req.user._id
+        doc.meta.owner_collection = req.ucollection
+      } else {
+        if (!req.hasPermission(`${req.params.collection}: modify owner`)) {
+          // has an owner - but if no permission to modify owner then override owner to logged in user
+          doc.meta.owner = req.user._id
+          doc.meta.owner_collection = req.ucollection
+        }
+      }
+    } else {
+      // request done by NOT logged in user
+      if (schema.enableLogin) {
+        // is a user/login collection so make self owner
+        doc.meta.owner = doc._id
+        doc.meta.owner_collection = req.params.collection
+      } else {
+        // is a normal collection
+        debug('unable to find valid owner')
+      }
+    }
+    if (doc.meta.owner) {
+      await validateDocumentOwner(req, doc)
+    }
+  }
+}
+
+exports.getSchema = async function (req) {
+  const collection = await req.db.collection.get(req.params.collection)
+  await util.notify('get', req, 'schemas', collection)
+  return collection.schema
+}
+
+exports.get = async function (req) {
+  assertValidCollection(req)
+  if (typeof req.db[req.params.collection] === 'undefined') {
+    throw new util.ApiError(404, 'unknown collection')
+  }
+
+  const fields = req.query.fields ? JSON.parse(req.query.fields) : null
+
+  let data, query
+  if (req.query.query) {
+    query = JSON.parse(req.query.query)
+    if (!req.getSetting('allow_where_in_api')) {
+      const operator = findCodeExecutionOperator(query)
+      if (operator) {
+        throw new util.ApiError(400, `${operator} is not allowed in the query parameter`)
+      }
+    }
+  }
+  else {
+    const { skip, offset, limit, page, pageitems, pagemetadisable, orderby, ...params } = req.query // eslint-disable-line no-unused-vars
+    delete params.fields
+    query = queryStringParser.parse(params)
+  }
+  if (req.query.orderby) {
+    req.query.orderby = JSON.parse(req.query.orderby)
+    req.query.orderby = util.normalizeOrderBy(req.query.orderby)
+  }
+
+  if (req.uid) {
+    // scenario where logged in user can only retrieve own docs
+    if (!req.hasPermission(`${req.params.collection}: view`) && req.hasPermission(`${req.params.collection}: view own`)) {
+      query['meta.owner'] = req.uid
+      // if fields is null then all fields are requested
+      if (fields) fields['meta.owner'] = 1
+    }
+  }
+
+  if (req.query.page != null) {
+    req.query.page = parseInt(req.query.page)
+    if (req.query.page <= 0) {
+      throw new util.ApiError(400, 'invalid page number')
+    }
+    req.query.pageitems = parseInt(req.query.pageitems) || parseInt(req.query.limit) || 10
+    req.query.offset = util.getDatabaseOffset(req.query.page, req.query.pageitems)
+    req.query.orderby = util.orderByForPagedRequests(req.query.orderby)
+    delete req.query.limit
+    delete req.query.skip
+    let pageData, totalItems
+    if (req.query.pagemetadisable) {
+      // a way to skip the extra count database call, but lose additional page detail
+      pageData = await req.db[req.params.collection].find(query, req.query.offset, req.query.pageitems, req.query.orderby, fields)
+    }
+    else {
+      // this is default - full detail
+      [pageData, totalItems] = await Promise.all([
+        req.db[req.params.collection].find(query, req.query.offset, req.query.pageitems, req.query.orderby, fields),
+        req.db[req.params.collection].count(query)
+      ])
+    }
+    await Promise.all(pageData.map((doc) => util.notify('get', req, req.params.collection, doc)))
+    data = util.createPagePagination(pageData, req.query.page, req.query.pageitems, totalItems)
+  }
+  else {
+    if (req.query.limit) {
+      req.query.limit = parseInt(req.query.limit)
+    }
+    if (req.query.skip) {
+      req.query.offset = parseInt(req.query.skip)
+      delete req.query.skip
+    }
+    else if (req.query.offset) {
+      req.query.offset = parseInt(req.query.offset)
+    }
+    data = await req.db[req.params.collection].find(query, req.query.offset, req.query.limit, req.query.orderby, fields)
+    await Promise.all(data.map((doc) => util.notify('get', req, req.params.collection, doc)))
+  }
+
+  await util.notify('getpresend', req, req.params.collection, data)
+  return data
+}
+
+exports.insert = async function (req) {
+  assertValidCollection(req)
+  const data = req.body
+  req.customResponseData = req.customResponseData || {}
+  await util.notify('post', req, req.params.collection, data)
+  await setDocumentOwner(req, data)
+  const id = await req.db[req.params.collection].create(data)
+  await util.notify('changed', req, req.params.collection, data)
+  return {
+    status: 'OK',
+    id: id,
+    ...req.customResponseData,
+  }
+}
+
+exports.getById = async function (req) {
+  assertValidCollection(req)
+  const fields = req.query.fields ? JSON.parse(req.query.fields) : null
+  const data = await req.db[req.params.collection].get(req.params.id, fields)
+  await util.notify('get', req, req.params.collection, data)
+  await util.notify('getpresend', req, req.params.collection, data)
+  return data
+}
+
+exports.replaceById = async function (req) {
+  assertValidCollection(req)
+  req.customResponseData = req.customResponseData || {}
+  const data = req.body
+  let oldDoc = {}
+  try {
+    oldDoc = await req.db[req.params.collection].get(req.params.id)
+  } catch (error) {
+    // happens when new documents are created via a PUT
+    oldDoc = { meta: { owner: req.user._id, owner_collection: 'users' } }
+    data._id = req.params.id.trim()
+    await setDocumentOwner(req, data)
+  }
+  if (data._id) {
+    data._id = data._id.trim()
+  } else {
+    data._id = req.params.id.trim()
+  }
+  data.meta = data.meta || {}
+  data.meta.created = (oldDoc.meta || {}).created
+  if (data.meta.owner !== oldDoc.meta.owner || data.meta.owner_collection !== oldDoc.meta.owner_ollection) {
+    if (req.hasPermission(`${req.params.collection}: modify owner`)) {
+      if (oldDoc.meta.owner) {
+        await validateDocumentOwner(req, data)
+      }
+    } else {
+      debug('attempting to change document owner.')
+      data.meta.owner = oldDoc.meta.owner
+      data.meta.owner_collection = oldDoc.meta.owner_collection
+    }
+  }
+  await util.notify('put', req, req.params.collection, data)
+  await req.db[req.params.collection].update(req.params.id, data)
+  await util.notify('changed', req, req.params.collection, data)
+  return {
+    status: 'OK',
+    id: data._id,
+    ...req.customResponseData,
+  }
+}
+
+exports.updateById = async function (req) {
+  assertValidCollection(req)
+  req.customResponseData = req.customResponseData || {}
+  const modifier = req.body
+
+  const doc = await req.db[req.params.collection].get(req.params.id)
+  const owner = doc.meta && doc.meta.owner
+  const ownerCollection = doc.meta && doc.meta.owner_collection
+  util.mongoUpdate(doc, modifier)
+  const newOwner = doc.meta && doc.meta.owner
+  const newOwnerCollection = doc.meta && doc.meta.owner_collection
+  if (owner !== newOwner || ownerCollection !== newOwnerCollection) {
+    if (req.hasPermission(`${req.params.collection}: modify owner`)) {
+      if (owner) {
+        await validateDocumentOwner(req, doc)
+      }
+    } else {
+      debug('attempting to change document owner.')
+      doc.meta.owner = owner
+      doc.meta.owner_collection = ownerCollection
+    }
+  }
+  if (doc._id) {
+    doc._id = doc._id.trim()
+  } else {
+    throw new util.ApiError(400, '_id property is required')
+  }
+  req.body = doc
+  await util.notify('put', req, req.params.collection, doc)
+  await req.db[req.params.collection].update(req.params.id, req.body)
+  await util.notify('changed', req, req.params.collection, req.body)
+  if (Object.keys(req.customResponseData)) {
+    return {
+      ...doc,
+      ...req.customResponseData,
+    }
+  }
+  return doc
+}
+
+exports.deleteById = async function (req) {
+  assertValidCollection(req)
+  req.customResponseData = req.customResponseData || {}
+  const doc = await req.db[req.params.collection].get(req.params.id)
+  await util.notify('delete', req, req.params.collection, doc)
+
+  await req.db[req.params.collection].delete(req.params.id)
+  await util.notify('deleted', req, req.params.collection, doc)
+  return {
+    status: 'OK',
+    ...req.customResponseData,
+  }
+}